CVE-2023-33945
Assigner: Liferay
Published: 2023-05-24T15:22:39.081Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Portal
vendor: Liferay
versions: lessThanOrEqual: 7.4.3.17
status: affected
version: 7.3.1
versionType: maven
defaultStatus: unaffected
product: DXP
vendor: Liferay
versions: lessThanOrEqual: 7.3.10.u5
status: affected
version: 7.3.10
versionType: maven
lessThanOrEqual: 7.4.13.u17
status: affected
version: 7.4.13
versionType: maven
descriptions: supportingMedia: base64: no
type: text/html
value: SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.
value: SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev